CVE-2022-20692 Overview
CVE-2022-20692 is a denial of service (DoS) vulnerability in the NETCONF over SSH feature of Cisco IOS XE Software. The flaw stems from insufficient resource management when handling concurrent NETCONF sessions. A low-privileged, authenticated, remote attacker can exploit this issue by initiating a large number of NETCONF over SSH connections to exhaust device resources. Successful exploitation causes the affected device to reload, resulting in a service outage. The vulnerability is tracked under [CWE-400: Uncontrolled Resource Consumption] and carries an EPSS probability of 0.715% (72.5th percentile).
Critical Impact
An authenticated attacker with low privileges can trigger an unplanned device reload, disrupting network operations on Cisco IOS XE routers and switches that have NETCONF over SSH enabled.
Affected Products
- Cisco IOS XE Software releases 3.15.x (3.15.1xbs, 3.15.2xbs)
- Cisco IOS XE Software 16.3 through 16.12 release trains
- Cisco IOS XE Software 17.1.x through 17.2.x release trains
Discovery Timeline
- 2022-04-15 - CVE-2022-20692 published to the National Vulnerability Database
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2022-20692
Vulnerability Analysis
The vulnerability resides in the NETCONF over SSH subsystem of Cisco IOS XE Software. NETCONF is a network management protocol defined in RFC 6241 used to install, manipulate, and delete the configuration of network devices. When transported over SSH, each client session consumes memory and process resources on the device.
The affected implementation does not adequately bound the resources allocated to concurrent NETCONF sessions. An attacker who has valid credentials, even at a low privilege level, can repeatedly establish NETCONF over SSH connections. As session counts grow, resource consumption escalates until the device can no longer sustain normal operation and reloads.
Because the attack requires only authentication and network reachability, environments that expose NETCONF management to broad user populations face elevated risk.
Root Cause
The root cause is insufficient resource management within the NETCONF over SSH session handling logic. The service lacks effective limits or throttling on the number of simultaneous sessions a single authenticated user can establish, allowing connection flooding to exhaust shared resources.
Attack Vector
Exploitation requires network access to the management plane and valid low-privilege credentials. An attacker scripts repeated NETCONF over SSH connection attempts using standard SSH clients or NETCONF tooling such as ncclient. Each new session further depletes device resources. Once resources are exhausted, the device reloads, producing a denial of service condition for all users and routed traffic dependent on the control plane.
No public proof-of-concept exploit code or weaponized exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2022-20692
Indicators of Compromise
- Unexpected device reloads with crash logs referencing the NETCONF process or memory exhaustion events.
- High volumes of SSH connections to TCP port 830 (or the configured NETCONF port) originating from a single source.
- Authentication logs showing rapid, repeated NETCONF subsystem requests from the same low-privilege account.
Detection Strategies
- Monitor show netconf-yang sessions and show processes memory output for abnormal session counts or memory growth.
- Enable AAA accounting and forward syslog events for NETCONF session establishment to a centralized SIEM for correlation.
- Alert on Cisco IOS XE syslog messages indicating low memory conditions, process restarts, or unscheduled reloads.
Monitoring Recommendations
- Track baseline NETCONF session counts per user and trigger alerts when thresholds are exceeded.
- Ingest device syslog and SNMP traps into a centralized logging platform to correlate device reloads with management plane activity.
- Use NetFlow or IPFIX records to identify spikes in connections to NETCONF service ports from internal hosts.
How to Mitigate CVE-2022-20692
Immediate Actions Required
- Apply the fixed Cisco IOS XE Software release referenced in the Cisco Security Advisory.
- Restrict NETCONF over SSH access to dedicated management networks using infrastructure access control lists (iACLs) and control plane policing.
- Rotate and audit credentials for accounts authorized to access NETCONF, removing unnecessary low-privilege accounts.
Patch Information
Cisco has released free software updates that address this vulnerability. Customers with service contracts should obtain the fixed release through normal update channels. Refer to the Cisco Security Advisory cisco-sa-ncossh-dos-ZAkfOdq8 for the specific first-fixed releases corresponding to each affected IOS XE train.
Workarounds
- Disable the NETCONF over SSH feature with no netconf-yang if it is not required for operations.
- Apply control plane policing (CoPP) policies to rate-limit inbound SSH traffic destined to the NETCONF port.
- Use AAA authorization to limit which users can invoke the NETCONF subsystem, reducing the population of accounts capable of triggering the issue.
# Example: restrict NETCONF access via control plane ACL and disable feature when unused
ip access-list extended ACL-MGMT-NETCONF
permit tcp 10.10.0.0 0.0.255.255 any eq 830
deny tcp any any eq 830 log
permit ip any any
!
control-plane
service-policy input COPP-NETCONF-LIMIT
!
! If NETCONF over SSH is not required:
configure terminal
no netconf-yang
end
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
